web pen testing on Prod and UAT

UAT on new application before launch to production. Fix the gaps before launch.

Production will be an annual one in accordance with TRM as company is under MAS regulations. Usually done during weekends or maintenance windows.

Typically, a UAT environment should mirror the Prod so that all the controls are same. And after testing or any scanning done at UAT, ensure the UAT environment is safe before pushing the same patch to Prod. But if you are going to do web pen test on Prod, i would suggest to do a black box testing and before that, just do a backup of everything.

thank u all for the advice.

u r welcome but seriously, just backup first. u wouldn't want ur management folks to scream if there's any data lost during the web PT

ask u guys, do u perform web PT on both Prod and UAT or either one? I know prod may seems tricky as it's live data but if we dun do on Prod then we won't know if its susceptible to vulnerabilities. opinions?

@mandyplayhard I think better scan UAT, last time i scan prod and mess up some prod data and got scolded by boss. ur prod and uat should have same controls then at least make sense.